Add 17 features: My Work view, card copy/numbering, calendar, bulk ops, custom fields, automations, webhooks, invites, import/export, and more

Features implemented across 6 batches:
- Batch A: Fix ColorPicker gradient sync, tenant custom logo, unarchive cards, board backgrounds
- Batch B: My Work view, card copy/duplicate, card numbering (BOARD-123)
- Batch C: Due date reminders (cron), card watching with notifications
- Batch D: Bulk card operations, column sorting, calendar view
- Batch E: Invite by link, board import/export (Pounce + Trello JSON)
- Batch F: Webhooks with HMAC signing, custom fields, automation rules engine

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

scripts/setup-rls.sql

@@ -60,6 +60,24 @@ ALTER TABLE notifications FORCE ROW LEVEL SECURITY;
 ALTER TABLE board_templates ENABLE ROW LEVEL SECURITY;
 ALTER TABLE board_templates FORCE ROW LEVEL SECURITY;
 
+ALTER TABLE tenant_invites ENABLE ROW LEVEL SECURITY;
+ALTER TABLE tenant_invites FORCE ROW LEVEL SECURITY;
+
+ALTER TABLE webhooks ENABLE ROW LEVEL SECURITY;
+ALTER TABLE webhooks FORCE ROW LEVEL SECURITY;
+
+ALTER TABLE card_watchers ENABLE ROW LEVEL SECURITY;
+ALTER TABLE card_watchers FORCE ROW LEVEL SECURITY;
+
+ALTER TABLE custom_field_defs ENABLE ROW LEVEL SECURITY;
+ALTER TABLE custom_field_defs FORCE ROW LEVEL SECURITY;
+
+ALTER TABLE custom_field_values ENABLE ROW LEVEL SECURITY;
+ALTER TABLE custom_field_values FORCE ROW LEVEL SECURITY;
+
+ALTER TABLE automation_rules ENABLE ROW LEVEL SECURITY;
+ALTER TABLE automation_rules FORCE ROW LEVEL SECURITY;
+
 -- ─── Tenant-scoped tables (direct tenant_id) ──────────
 
 -- Users
@@ -336,6 +354,112 @@ CREATE POLICY attachments_tenant_isolation ON attachments
     )
   );
 
+-- ─── New tenant-scoped tables ────────────────────────
+
+-- Tenant Invites
+DROP POLICY IF EXISTS tenant_invites_tenant_isolation ON tenant_invites;
+CREATE POLICY tenant_invites_tenant_isolation ON tenant_invites
+  USING (
+    current_setting('app.current_tenant_id', true) = '__bypass__'
+    OR tenant_id::text = current_setting('app.current_tenant_id', true)
+  )
+  WITH CHECK (
+    current_setting('app.current_tenant_id', true) = '__bypass__'
+    OR tenant_id::text = current_setting('app.current_tenant_id', true)
+  );
+
+-- Webhooks
+DROP POLICY IF EXISTS webhooks_tenant_isolation ON webhooks;
+CREATE POLICY webhooks_tenant_isolation ON webhooks
+  USING (
+    current_setting('app.current_tenant_id', true) = '__bypass__'
+    OR tenant_id::text = current_setting('app.current_tenant_id', true)
+  )
+  WITH CHECK (
+    current_setting('app.current_tenant_id', true) = '__bypass__'
+    OR tenant_id::text = current_setting('app.current_tenant_id', true)
+  );
+
+-- Card Watchers (via card -> column -> board)
+DROP POLICY IF EXISTS card_watchers_tenant_isolation ON card_watchers;
+CREATE POLICY card_watchers_tenant_isolation ON card_watchers
+  USING (
+    current_setting('app.current_tenant_id', true) = '__bypass__'
+    OR card_id IN (
+      SELECT ca.id FROM cards ca
+      JOIN columns c ON ca.column_id = c.id
+      JOIN boards b ON c.board_id = b.id
+      WHERE b.tenant_id::text = current_setting('app.current_tenant_id', true)
+    )
+  )
+  WITH CHECK (
+    current_setting('app.current_tenant_id', true) = '__bypass__'
+    OR card_id IN (
+      SELECT ca.id FROM cards ca
+      JOIN columns c ON ca.column_id = c.id
+      JOIN boards b ON c.board_id = b.id
+      WHERE b.tenant_id::text = current_setting('app.current_tenant_id', true)
+    )
+  );
+
+-- Custom Field Defs (via board)
+DROP POLICY IF EXISTS custom_field_defs_tenant_isolation ON custom_field_defs;
+CREATE POLICY custom_field_defs_tenant_isolation ON custom_field_defs
+  USING (
+    current_setting('app.current_tenant_id', true) = '__bypass__'
+    OR board_id IN (
+      SELECT id FROM boards
+      WHERE tenant_id::text = current_setting('app.current_tenant_id', true)
+    )
+  )
+  WITH CHECK (
+    current_setting('app.current_tenant_id', true) = '__bypass__'
+    OR board_id IN (
+      SELECT id FROM boards
+      WHERE tenant_id::text = current_setting('app.current_tenant_id', true)
+    )
+  );
+
+-- Custom Field Values (via card -> column -> board)
+DROP POLICY IF EXISTS custom_field_values_tenant_isolation ON custom_field_values;
+CREATE POLICY custom_field_values_tenant_isolation ON custom_field_values
+  USING (
+    current_setting('app.current_tenant_id', true) = '__bypass__'
+    OR card_id IN (
+      SELECT ca.id FROM cards ca
+      JOIN columns c ON ca.column_id = c.id
+      JOIN boards b ON c.board_id = b.id
+      WHERE b.tenant_id::text = current_setting('app.current_tenant_id', true)
+    )
+  )
+  WITH CHECK (
+    current_setting('app.current_tenant_id', true) = '__bypass__'
+    OR card_id IN (
+      SELECT ca.id FROM cards ca
+      JOIN columns c ON ca.column_id = c.id
+      JOIN boards b ON c.board_id = b.id
+      WHERE b.tenant_id::text = current_setting('app.current_tenant_id', true)
+    )
+  );
+
+-- Automation Rules (via board)
+DROP POLICY IF EXISTS automation_rules_tenant_isolation ON automation_rules;
+CREATE POLICY automation_rules_tenant_isolation ON automation_rules
+  USING (
+    current_setting('app.current_tenant_id', true) = '__bypass__'
+    OR board_id IN (
+      SELECT id FROM boards
+      WHERE tenant_id::text = current_setting('app.current_tenant_id', true)
+    )
+  )
+  WITH CHECK (
+    current_setting('app.current_tenant_id', true) = '__bypass__'
+    OR board_id IN (
+      SELECT id FROM boards
+      WHERE tenant_id::text = current_setting('app.current_tenant_id', true)
+    )
+  );
+
 -- ─── User-scoped tables ───────────────────────────────
 
 -- Notifications